aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6

Analysis

max time kernel
25s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11-10-2022 18:48

Target

aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll
Size

148KB
MD5

246ee48e6365e7ca619c184a08fb2c40
SHA1

1f3a18648961d22836316e6275c9fc5c785ee405
SHA256

aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6
SHA512

0f69fc9253889f6cf415ddc1660ea2483ea20354d642e7e9e4d1c93a2efe7390b20d452ca185cc98ed1d1793ec9dc31112ab3b6985c1fe99e8125ff219ba66ee
SSDEEP

3072:xHNIjFagzS+8NDdeA9DQ2G/O2pB+zcZbvdpe7VNS:/IjoE8bP0NpBw0FpeR

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27
PID 1904 wrote to memory of 996	1904	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b516a546185f89b2da524bb593c51d4ebebbfb7bb83a7990e6da50df533a6.dll,#1
  2⤵
  PID:996

memory/996-55-0x00000000762D1000-0x00000000762D3000-memory.dmp

Filesize
8KB

Download
memory/996-56-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download
memory/996-57-0x0000000010000000-0x0000000010025000-memory.dmp

Filesize
148KB

Download